Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #81777 > unrolled thread

Re: Cherrypy - prevent browser "prefetch"?

Back to article view | Back to comp.lang.python

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Cherrypy - prevent browser "prefetch"? Tim Chase <python.list@tim.thechases.com> - 2014-12-01 15:26 -0600
    Re: Cherrypy - prevent browser "prefetch"? "Christoph M. Becker" <cmbecker69@arcor.de> - 2014-12-01 22:44 +0100
      Re: Cherrypy - prevent browser "prefetch"? Tim Chase <python.list@tim.thechases.com> - 2014-12-01 16:04 -0600

#81777 — Re: Cherrypy - prevent browser "prefetch"?

On 2014-12-01 11:28, Israel Brewster wrote:
> I don't know if this is a cherrypy specific question (although it
> will be implemented in cherrypy for sure), or more of a general
> http protocol question, but when using cherrypy to serve a web app,
> is there anyway to prevent browser prefetch? I'm running to a
> problem, specifically from Safari on the Mac, where I start to type
> a URL, and Safari auto-fills the rest of a random URL matching what
> I started to type, and simultaneously sends a request for that URL
> to my server, occasionally causing unwanted effects.

This SO post[1] suggests that Firefox sets/sends a

  X-moz: prefetch

header, while Safari and Chrome use the

  X-Purpose: preview

header.  You could create a decorator that sniffs those headers and
reacts accordingly.  Though be aware that, based on my reading,
Safari only sends that X-Purpose header for the base page, not any
referenced assets (JS, CSS, images, etc).

Also, while I can't find any documentation on how Safari/Chrome(ium)
handle it, if your logout/ page sends an HTTP/302 redirect to a final
landing page, Safari/Chrome(ium) may be smart enough to not suggest
(and thus not prefetch) the bounce page, only the landing page.  I
haven't investigated recently, but I remember Django's ability to
trigger a log-out merely via a GET was something that irked me.

I don't have a recent version of Safari (my only Apple machine is a
PPC iBook laptop running 10.4 which no longer receives any updates)
so I can't verify that this header is actually being sent in the case
you describe, but it would be where I'd start hunting.

All this to also say that performing non-idempotent actions on a GET
request is just begging for trouble. ;-)

-tkc

[1]
http://stackoverflow.com/questions/9852257/http-header-to-detect-a-preload-request-by-google-chrome

[toc] | [next] | [standalone]

#81778

Tim Chase wrote:

> I
> haven't investigated recently, but I remember Django's ability to
> trigger a log-out merely via a GET was something that irked me.
> 
> All this to also say that performing non-idempotent actions on a GET
> request is just begging for trouble. ;-)

ACK.  However, isn't log-out an idempotent action?

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#81780

On 2014-12-01 22:44, Christoph M. Becker wrote:
> Tim Chase wrote:
> > haven't investigated recently, but I remember Django's ability to
> > trigger a log-out merely via a GET was something that irked me.
> > 
> > All this to also say that performing non-idempotent actions on a
> > GET request is just begging for trouble. ;-)
> 
> ACK.  However, isn't log-out an idempotent action?

A minor note here...the OP talked about CherryPy and I've been in
Django-land too long that I started talking Django.  I'd have
to pick open the scabs of my CherryPy experience to answer about CP.

But yes, it appears that Django's contrib.auth module still allows
for performing a logout/ on a GET (something I remember
encountering/researching several years ago) rather than limiting it to
a POST. As best I can tell, it doesn't even check the refer(r)er, so
this charmingly means that I can put a tag like

 <img src="http://yoursite.example.com/logout/"> 

on *my* site, and it will log you out from yoursite.example.com
despite.  Not even a CSRF-token check because it's not a POST.

-tkc

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.python

csiph-web